Adversary capabilities: We assume that any untrusted device \(I_i\)  strictly follows the collaborative inference protocols. Particularly, it receives \(in=f^j_{\theta }(y)\)  from \(I_j\)  and generates \(out=f^i_{\theta }(in)\) , without being able to compromise the task processed by \(I_j\) . Moreover, in black-box settings, the adversary has no knowledge about the weights, parameters or structure of the segments owned by previous participants except \(f^i_{\theta }\) , the input \(in\) , and the distribution of the data, which makes it more challenging to inverse the data. Meaning, without knowing the model parameters, the malicious participant cannot apply a gradient descent optimization to map the received input to the original image collected by the source device. Yet, after receiving the output feature maps from a previous participant, key insights and information can be extracted to reconstruct the sensitive data [1]}. Authors in [2]} proved that even without collecting any insight, an inverse network can be trained to identify the inversion mapping from the received input to the original image. Conceptually, an inverse network, created from a segment \(f^{i+1}_{\theta }\) , can be defined as \(g=(f^{i+1}_{\theta })^{-1}\)  and trained with the inputs received from a previous device \(in=f^i_{\theta }(x)\) , where \(x\)  denotes the original image and the desired inversion output. The loss function is expressed as follows:
\(\footnotesize \begin{aligned}L(g^{(t)})=\frac{1}{k}\sum _{i=1}^k \left\Vert g(f_{\theta }(x_i))-x_i\right\Vert ^2_2\end{aligned}\) 
